FCP key terms

An integrated architecture that lets FortiGate firewalls, endpoints, switches, and cloud tools share telemetry and enforce coordinated policy, giving one console visibility across the whole topology instead of isolated device views.

A configuration role that authorizes one Fabric device to join another, establishing the trust link used to exchange logs, device inventory, and threat intelligence between FortiGates and other Fabric members.

The protocol FortiGates use to detect and exchange information with FortiClient endpoints, enabling device identity awareness, compliance checks, and automatic quarantine of noncompliant hosts.

A scored checklist in FortiGate that grades configuration hygiene, such as firmware currency, logging, and policy best practices, and highlights gaps that weaken the overall security posture.

Logical groupings of one or more physical or VLAN interfaces that let a single firewall policy reference several segments at once, simplifying rule count and making policy intent easier to read.

An ordered rule matching source interface, source address, destination address, service, and schedule, then applying an action such as accept or deny plus profiles for inspection and logging.

A mode where SNAT and DNAT rules live in separate tables evaluated independently of firewall policies, so address translation is managed once rather than repeated inside each policy.

A destination NAT object that maps a public address and port to an internal server address and port, allowing inbound services to be published without exposing real internal addressing.

Controls that limit or prioritize bandwidth using shared or per-policy shapers, protecting latency-sensitive traffic and preventing any single flow from saturating a WAN link.

A bandwidth limiter applied to multiple firewall policies that enforces one aggregate rate across all matching traffic, unlike a per-policy shaper that limits each policy separately.

A firewall rule that decides which traffic triggers a user authentication prompt, and which authentication method and portal are used, before normal policy evaluation proceeds.

A named collection of local users, remote directory members, or RADIUS and LDAP identities referenced in policies so permissions are granted to roles rather than individual accounts.

A directory protocol FortiGate uses to query Active Directory or other directories for user records, group membership, and bind credentials during authentication and group matching.

Fortinet Single Sign-On, which learns logged-in domain users from collector agents or DC polling so firewall policies can match identities without prompting users for credentials again.

Requiring a second proof of identity beyond a password, such as a one-time token or push approval, before granting VPN or administrative access to a protected resource.

A remote-access service that tunnels client traffic over TLS, offering either a full tunnel or a bookmarked web portal, and is commonly used for browser-friendly access from any location.

A site-to-site or dial-up tunnel negotiated in two phases, where phase 1 protects the control channel and phase 2 defines the encrypted data selectors between peers.

The IPsec security association that specifies the encrypted subnet pairs and protocols carried inside a tunnel, along with its own lifetime and proposal settings.

A keepalive mechanism that probes an idle IPsec peer and tears down or rebuilds the tunnel when replies stop, avoiding black-holed traffic after a link failure.

A VPN setting that sends only selected destination subnets through the tunnel while other traffic exits locally, reducing bandwidth load and latency for internet browsing.

A security profile that classifies HTTP and HTTPS requests by category, reputation, or URL list and applies allow, block, or warning actions, often with safe-search enforcement.

A profile that identifies applications by signature rather than port, letting policy block, allow, or shape specific apps such as social media or peer-to-peer clients regardless of protocol.

Decrypting TLS sessions with a trusted re-signing certificate so content-based profiles can examine encrypted traffic, with exclusions for privacy-sensitive or certificate-pinned destinations.

A signature-based engine that inspects packet streams for exploit patterns and can reset, drop, or monitor matching traffic according to the profile's action and severity thresholds.

A profile that scans files and protocols for viruses and other malicious payloads, using signatures plus options such as blocking unknown files or emulating suspicious executables before delivery.

A reusable bundle of inspection settings, such as antivirus, IPS, web filter, and application control, attached to a firewall policy to govern how accepted traffic is examined.

A manually configured path that tells the firewall where to send traffic for a destination prefix, including the next-hop gateway and administrative distance used for preference.

A routing rule evaluated before the main routing table that forwards traffic based on policy criteria such as source address, protocol, or incoming interface, overriding normal destination lookup.

A feature that groups WAN links into a virtual interface and steers traffic per rule using health checks, so sessions fail over or prefer a link based on latency, jitter, and packet loss.

A probe that measures latency, jitter, and loss toward a target, feeding SD-WAN decisions so traffic moves to a link that satisfies the configured performance threshold.

Per-policy and global controls that decide which events are recorded, where logs are stored locally or sent remotely, and whether traffic is logged at start, end, or both.

A central logging and reporting appliance that receives logs from Fabric devices, correlates events, and produces dashboards and compliance reports that local storage cannot sustain.

A built-in diagnostic that records packets on a chosen interface with filters, producing a file for analysis when logs alone cannot explain why traffic is dropped or delayed.

A console command that traces a packet through the firewall step by step, showing route lookup, policy match, NAT, and drop reasons, which pinpoints why traffic is silently discarded.

A cluster of firewalls sharing a virtual address so one member actively forwards traffic while peers stand by or share sessions, preserving service if a unit or link fails.

Continuous replication of session and connection state between HA cluster members so established flows survive a failover without requiring clients to reconnect.

The event where a standby cluster member takes over the primary role after a monitored interface, heartbeat, or device failure, promoting itself and assuming the shared addresses.

An exported copy of the device configuration, ideally encrypted and stored off-box, used to restore settings after hardware replacement, failed upgrades, or accidental changes.

Installing a new FortiOS image, typically by following the supported upgrade path, checking compatibility, and keeping a backup so the device can be recovered if the boot fails.